Cloud computing may be on every higher education IT leader's mind, but where you are in the cycle of decision-making and implementation varies widely. As you navigate the cloudscape, you can use this overview as an entry into a wide range of resources and information on what others are doing.

As higher education faces budget restrictions and sustainability challenges, one approach to relieve these pressures is cloud computing. Although distinct definitions of "cloud computing" abound, the concept fundamentally involves delivering IT services to users over the Internet.

Demystifying Cloud Computing for Higher Education. ECAR Research Bulletin, September 22 2009. This bulletin is the first in a series of bulletins devoted to cloud computing in higher education. It summarizes insights and outlines a framework for thinking about cloud computing, and it touches on potential emergent roles for public and private clouds.

Cloud Characteristics

There are many views on and definitions of cloud computing. Below are various definitions, starting with a commonly cited one from the National Institute of Standards and Technology.

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.

Essential Characteristics

On-demand self-service. A consumer can provision computing capabilities as needed, such as server time and network storage, without requiring human interaction with each service's provider.

Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling. The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location-independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or data center). Examples of resources include storage, processing, memory, network bandwidth, and virtual machines.

Rapid elasticity. Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out, and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time.

Measured Service. Cloud systems automatically control and optimize resource use by leveraging a metering capability1 at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

For more information on the three service models and four deployment models, please see the publication NIST Draft January 2011.

Public/Private/Community Cloud

The three most common cloud models are the public cloud, private cloud, and the community cloud.

Public Cloud (External Cloud)

A public cloud is one based on the standard cloud computing model, in which a service provider makes resources, such as applications and storage, available to the general public over the Internet. Public cloud services may be free or offered on a pay-per-usage model. What is

Public cloud or external cloud describes cloud computing in the traditional mainstream sense, whereby resources are dynamically provisioned on a fine-grained, self-service basis over the Internet, via web applications/web services, from an off-site third-party provider who shares resources and bills on a fine-grained utility computing basis. Wikipedia

Private Cloud (Internal Cloud, Corporate Cloud)

Private cloud (also called internal cloud or corporate cloud) is a marketing term for a proprietary computing architecture that provides hosted services to a limited number of people behind a firewall.What Is

Some vendors have used the terms to describe offerings that emulate cloud computing on private networks. These products offer the ability to deliver some benefits of cloud computing whilst mitigating some of the pitfalls. These offerings capitalize on data security, corporate governance, and reliability concerns during this time of transition from a product to a functioning service-based industry supported by competitive marketplaces. Wikipedia

Community Cloud

The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on premise or off premise. ReadWriteEnterprise

A community cloud may be established where several organizations have similar requirements and seek to share infrastructure so as to realize some of the benefits of cloud computing. With the costs spread over fewer users than a public cloud (but more than a single tenant) this option is more expensive but may offer a higher level of privacy, security, and/or policy compliance. Examples of community cloud include Google's "Gov Cloud." Wikipedia

Service Definitions: IaaS, PaaS, SaaS

There many cloud service models including the three most common ones:

IaaS (Infrastructure as a Service) is a provision model in which an organization outsources the equipment used to support operations, including storage, hardware, servers, and networking components. The service provider owns the equipment and is responsible for housing, running, and maintaining it. The client typically pays on a per-use basis.

PaaS (Platform as a Service) is a paradigm for delivering operating systems and associated services over the Internet without downloads or installation. PaaS is sometimes called "cloudware" because it moves resources from privately owned computers into the Internet "cloud." Platform as a Service (PaaS)is an outgrowth of (SaaS), a software distribution model in which applications are hosted by a vendor or service provider and made available to customers over the Internet.

SaaS (Software as a Service) is a software distribution model in which applications are hosted by a vendor or service provider and made available to customers over a network, typically the Internet.

Additional Recommended Resources

Real-World Cloud Computing. EDUCAUSE 2010. This session explores three key issues related to cloud computing: What is it, and how does it differ from other styles of computing? What are its risks and challenges, and what are the ideal targets and best practices for using it? What long-term impact will it have on the market and vendors?

Cloud Computing—Transforming IT. Presentation from the 2009 ECAR Symposium, December 3, 2009. This session discusses the way cloud computing is changing the way we think of IT—from economics to process and usage models. Many organizations look to the cloud as a potential cost-savings boon by moving internally hosted IT services to external providers.

Cloud computing—is it right for your campus? Various decision points warrant investigation before your campus jumps into the cloud.

Featured Resources

What Campus Leaders Need to Know About Cloud Computing. EDUCAUSE Executive Briefing, April 2011. This briefing provides a high level overview of cloud computing, including how it changes IT service, financial models and the possible risk factors in moving services into the cloud.

Alternative IT Sourcing Strategies: From the Campus to the Cloud. ECAR Research Study, August 2009. This study explores a multitude of strategies used by colleges and university information technology organizations to deliver the breadth of technologies and services required by their institutions. Findings illustrate that although total outsourcing of institutional technology organizations is rare, so is self-operation of all IT functions and services.

Shaping the Higher Education Cloud. EDUCAUSE white paper, May 2010. This paper captures key findings from a two-day EDUCAUSE/NACUBO Cloud Computing Workshop that was held to explore what shape a higher education cloud might take and to identify opportunities and models for partnering.

Financial and Risk Analysis

Before moving any institutional services to the cloud computing, campus leaders need to weigh the associated risks. Detailed research should be part of decision-making process and will help mitigate those risks, such as making sure that prospective vendor is financially stable.

Embracing the Cloud: Caveat Professor. The Chronicle of Higher Education. May 2011. This author provides solid privacy risk reasoning on why students and instructors need to be educated about utilizing cloud storage options.

What Campus Leaders Need to Know About Cloud Computing. EDUCAUSE Executive Briefing, April 2011. This briefing provides a high level overview of cloud computing, including how it changes IT service, financial models and the possible risk factors in moving services into the cloud.

Cloud Computing and the Power to Choose, EDUCAUSE Review, vol. 45, no. 3 (May/June 2010). This article cites examples from Australia, Canada, the Netherlands, and the United Kingdom to illustrate both the opportunities and the risks involved in adopting cloud computing and cloud services.

Cloud Computing: Hype or Hope? This video from the 2009 EDUCAUSE Annual meeting provides a forum for two IT leaders to debate the pros and cons of moving critical services to the cloud.

Alternative IT Sourcing Strategies: From the Campus to the Cloud. ECAR Research Study, August 2009. This study explores a multitude of strategies used by colleges and university information technology organizations to deliver the breadth of technologies and services required by their institutions. Findings illustrate that although total outsourcing of institutional technology organizations is rare, so is self-operation of all IT functions and services.

Policy Implications

Institutions need address legal questions regarding whether data may be stored in the cloud and what type of contracts need to be drawn up when outsourcing said data storage. These and other legal and policy questions are identified in resources below.

Clouds: From Both Sides Now. This video from the 2010 EDUCAUSE meeting explores various questions IT leaders should be asking prior to moving services into the cloud.

Legal Implications of Cloud Computing—Part One (the Basics and Framing the Issues) and Legal Implications of Cloud Computing—Part Two (Privacy and the Cloud). These two 2009 articles reprinted on LLRX.com bring up various legal issue that should be contemplated prior to moving a school's services into the cloud.

Outsourcing and Cloud Computing for Higher Education. This 2009 Cornell University document summarizes what cloud computing is, areas in the information technology arena that are available for outsourcing, and some of the obvious and not-so-obvious challenges of outsourcing. Included is a focused checklist on some legal and policy issues to address in contracts between institutions and outsourcing entities. Finally, it includes two recommendations, one for an internal procedure by which to address these issues, and the other for a collaborative approach to some of these challenges from the perspective of higher education.

Partly Cloudy? What a CBO Should Know about Cloud Computing. This presentation, from the NACUBO 2009 Annual Meeting, highlights key issues for business officers as they consider contracting with outside services providers. The presenters also facilitate an informal discussion to share experiences, explore opportunities, and identify concerns related to cloud computing.

Computing in the Cloud. A 2008 workshop by Princeton University`s Center for Information Technology Policy. Experts from computer science, law, politics and industry explore the social and policy implications of computing in the cloud.

Security

Along with security implications, this section also deals with Identity Management and Privacy issues in the cloud.

Cloud Computing Risk Assessment. ENISA, November 2009. This is an in-depth and independent analysis that outlines some of the information security benefits and key security risks of cloud computing, and it provides a set of practical recommendations.

Identity Management

Federated Identity: A Recipe for Higher Education. EDUCAUSE Quarterly, vol. 33, no. 2, 2010. The author discusses how federated identity provides more control over privacy and personal security, which will prove beneficial in a cloud environment.

Identity Management and Trust Services: Foundations for Cloud Computing. EDUCAUSE Review, vol. 44, no. 5 (September/October 2009). This article explains that as IT organizations move to becoming integrators of IT services provided both locally and in the cloud, institutions must begin to plan for shared services and understand the essential role that identity management and trust services play in making this integration possible.

New Directions in Federation. ECAR Research Study, November 2009. This study highlights the trend toward outsourced applications and more collaboration between business partners and the strains of the capabilities of traditional identity management technologies. The industry is responding to growing demands by offering federation in a range of delivery models including open source, identity federation as a hosted service, and on-premises software. While federation implementations grow at a healthy rate, the industry continues to address barriers to further adoption.

Privacy Implications

Cloud Computing in Education, This video produced by TeachPrivacy, discusses the benefits and risks of educational institutions using cloud computing providers. Advice is provided for how educational institutions should choose cloud providers, establish a relationship with them, and maintain that relationship with the appropriate protections for privacy and data security.

Business Case

As colleges and universities weigh the cloud risks, various campus and information services will present themselves as acceptable business cases to make the move into the cloud.

Cloud Support for Web Development. EDUCAUSE Quarterly, vol. 33, no. 2, 2010. The author offers various examples of how cloud computing helps institutions explore and solve possible storage, bandwidth, or testing issues in the short term before long-term decisions are made.

Innovating in the Cloud: Exploring Cloud Computing to Solve IT Challenges. EDUCAUSE Quarterly, vol. 33, no. 2, 2010. This article discusses various motivations to consider the cloud. These include outdated technology, lack of funding, regional cost of living, stressed IT staff, natural disaster and emergency preparedness, and the ongoing global economic meltdown.

Partnership of Four: Managing Alternative Sourcing at Oakland University. ECAR Case Study, August 2009. This case study examines the ways in which one institution, Oakland University, has organized and created an administrative process to cope with the challenges of the procurement and management of IT services. It describes the factors that have driven extensive use of alternative IT sourcing, the institution's Partnership of Four, and the benefits and challenges that external IT sourcing has brought to Oakland.

Spotlight on Cloud Computing: Impact! This ELive! session asks the following questions: Is the cloud service an extension of your culture or are you adapting to their culture? What management and organizational challenges are presented?

Clearing the Air on Cloud Computing. EDUCAUSE Review, vol. 45, no. 3 (May/June 2010). This article points out that cloud computing is yet another story in a long-running argument about whether to create large, consolidated service centers and link them to users through data networking or whether to distribute computing resources among users.

Looking at Clouds from All Sides Now. EDUCAUSE Review, vol. 45, no. 3 (May/June 2010). Higher education and corporate leaders offer their perspectives on the promise and perils that may lie ahead for cloud computing and above-campus services.

Collaboration in Higher Education and Its Benefits for ICT. EDUCAUSE Quarterly, vol. 33, no. 1, 2010. This article points out that cloud computing offers opportunities to rethink how technology is provided and exploited within research, learning and teaching, and the management of colleges and universities.

Above the Clouds: A Berkeley View of Cloud Computing. UC Berkeley Technical Report, February 2009. This report defines cloud terms, presents an economic model that quantifies the key buy vs. pay-as-you-go decision, offers a spectrum to classify cloud computing providers, and gives Berkeley's view of the top 10 obstacles and opportunities to the growth of cloud computing.

Cloud Computing: Services, Economics, and Impacts. EDUCAUSE Annual Conference, November 6, 2009. This session discusses the transition of IT services and responsibilities for infrastructure, functions, and support from institutions to either larger-scale enterprises or consumer providers. Included are the kinds of enterprise activities that lend themselves well to extramural sourcing as well as risks and how to mitigate them.

Professional Development

Professional Development and Staffing for the Cloud. EDUCAUSE Live! August 25, 2010. This ELive! webinar provides an overview on staffing issues when using cloud services. Questions asked include: What are the types and levels of information that IT professionals must understand and advance in the growing space of cloud computing? How will technical work change? How will the staff gain skill sets in negotiation, interorganizational collaboration, and risk management?

Structuring the IT Organization for Cloud Services. ECAR Research Bulletin, June 2010. This bulletin is based on recent ECAR research on the continuing evolution of the IT help desk and the ramifications of above-campus services and cloud computing for higher education institutions.

Governance

Security Guidance for Critical Areas of Focus in Cloud Computing V2.1. CSA, December 2009. Starting on page 26, this publication discusses several areas of governance and suggested guidance for those specific areas. Areas of governance include governance and enterprise risk management, legal and electronic discovery, compliance and audit, information lifecycle management, and portability and interoperability.

Policy, Legal Issues, and Exit Strategies

Cloud policy encompasses several key components that help build a solid guide for schools to enter into service contracts with cloud vendors. These include the ability to write cloud-specific RFPs, contracts, and SLAs that minimize legal issues down the road.

The Common Solutions Group (CSG) and National Association of College and University Attorneys (NACUA) recently developed standard language upon which colleges and universities might base their engagements with vendors of outsourced collaboration services. They have developed a Model RFP and have included a summary of issues related to RFP. Other documents developed by this collaboration include Model Contracts as well as a summary of issues related to contracts.

Is There Safety in the Cloud?EDUCAUSE Quarterly, vol. 33, no. 2, 2010 The author provides a list of questions that should be incorporated into RFPs and contract negotiations.

New Directions in Federation. This November 2009 ECAR/Burton study follows the trend toward outsourced applications and more collaboration between business partners and the strained capabilities of traditional identity management technologies. The industry is responding to growing demands by offering federation in a range of delivery models that includes open source, identity federation as a hosted service, as well as on-premises software form factors.

Cloud Computing Security. This is a Higher Education Information Security Council (HEISC) wiki that provides a wealth of information on security, privacy, identity, and other compliance implications of moving data into the cloud.

Additional Recommended Resources

Above-Campus Services: Demand Aggregation Progress and Roadmap. This EDUCAUSE Annual Conference 2010 session assesses progress in creating and implementing new models for IT services that take advantage of fast networks, demand aggregation, and multi-institutional collaboration, including commercial partners.

Below is a collection of example case studies of cloud computing implementations in higher education, organized by service type.

Data Centers

Owning a Data Center Is So Last Century! A full-service data center contracting operation could deliver access that is leased, not owned. This video from EDUCAUSE 2010 argues that the time for radical change is now.

E-Mail Outsourcing

Google Apps at USF: From Development to Deployment and Beyond. This video from EDUCAUSE 2010 highlights the successes and challenges that USF has faced moving student e-mail to Google Apps and offers practical knowledge for institutions that either are investigating outsourced e-mail or have recently taken the plunge.

Spotlight on Cloud Computing Series: Google Apps at Brown. EDUCAUSE Live! August 2010. About a year ago, Brown deployed Google Apps to its 6,000 students and has now decided to extend the service to include faculty and staff as well. This webcast tells how these decisions were made, the options considered, difficulties surmounted, and successes to date.

A Tale of Two Clouds. Terry Gray, EDUCAUSE Quarterly, vol. 33, no. 2, 2010. The University of Washington adopted a dual-provider cloud-computing strategy, focusing initially on software as a service. The original project—to replace an obsolete alumni e-mail system—resulted in a cloud solution that soon grew to encompass the entire campus community. The policies and contract terms UW developed—focusing on compliance and reducing barriers to collaboration among faculty, staff, and students—provide a solid foundation for additional cloud computing endeavors.

Cloud Computing for the Academic Institution. EDUCAUSE Live! July 2009. The Virtual Computing Lab (VCL) is a cloud computing solution designed to address the unique needs of academic institutions. Computational resources for teaching faculty, students, and researchers require flexibility to be effective in diverse environments. This talk presents an overview of the VCL and discusses the computing resource problems that initiated it, the advantages and limitations of its use, and its pedagogical impact, as well as the economic implications of cloud computing.

EDUCAUSE Staff Picks

Internet2 NET+, Internet2 is working with third-party vendors to provide customized cloud services using the infrastructure facilities of the Internet2 Network and the federated authentication and authorization services available through InCommon.